Methodology

Health score

A 0–100 blend of four sub-scores, each answering one question a person asks before installing. The table lists the three that always apply; security, the fourth, is described below it. Grades: A ≥ 85, B ≥ 70, C ≥ 55, D ≥ 40, F below that.

Health is deliberately slow-moving: it measures whether a plugin is cared for, not whether it shipped a release this month. Download momentum used to sit here, but wp.org downloads are dominated by auto-update pushes, so it swung a plugin's grade on release timing rather than quality. Growth now lives on the movers boards, measured on installs.

Security carries 15% of the score, from the Wordfence Intelligence disclosures on the plugin's own record. An unpatched disclosure, or one whose affected range still covers the current release, weighs heavily; a history of disclosures since fixed weighs lightly, and a disclosure in the last 90 days costs a little on top. When security applies, the three weights above scale to 85% of the total (maintenance 34%, rating quality 29.75%, support 21.25%) and security supplies the remaining 15%.

Where we hold no disclosures at all, security is left out and the other three factors carry the whole score. That is deliberate. Of the plugins we track, roughly 7,500 carry a disclosure and 54,000 carry none, and an empty record usually means nobody has looked rather than that there is nothing to find. Scoring silence as a clean bill of health would reward the unexamined and mark down the audited, which is backwards. So a plugin with no record is graded on what we can measure, and says so rather than claiming a security score it hasn't earned.

Security began counting on 17 September 2026. A plugin with open disclosures will show a step down in its health trend on that date. The step is the score correcting, not the plugin changing, and we don't rewrite the earlier history to hide it.

Adjusted rating

Raw star averages reward tiny samples: a 5.0★ plugin with 4 reviews is weaker evidence than a 4.6★ plugin with 900. We apply Bayesian shrinkage toward the directory-wide average (3.9★) with the pull of twelve phantom reviews, so small samples drift toward typical and large samples speak for themselves. That is why an adjusted rating always sits slightly below a small plugin's raw average.

Install estimates

WordPress.org reports active installs only in coarse buckets ("40K+"). The true value sits between that bucket and the next one up. We narrow the tier using the date the plugin last crossed into its bucket, its download velocity since, and daily snapshots of our own. Estimates are labeled "modeled" until we hold enough of our own observations to call them "tracked".

Merit rankings

We replicated WordPress.org's search scoring from its public source: the install-count factor grows without any ceiling, so raw distribution dominates placement. Our merit re-rank applies the same inputs with three changes: the install factor is capped at one million active installs, ratings are weighted by review volume with a statistical lower bound (Wilson interval), and freshness/compatibility decay stays as wp.org has it. "Inflation" is the gap between a plugin's wp.org position and its merit position.

Signals on ranking rows

• install-weight boost — wp.org places this plugin 4+ positions above its merit rank, and the install-count factor supplies most of its wp.org score. This describes how the algorithm weighs the plugin. It says nothing about how those installs were acquired, and it is not an accusation against the developer.
• thin reviews — fewer than 25 reviews, so rating evidence is weak.
• low rating, top placement — under 3.5★ while holding a top-5 spot.
• stale but ranked — no update in 18 months while holding a top-10 spot.

History signals

Every daily snapshot stores installs, downloads, rating, review count, health, and directory rank per plugin. The trend surfaces below are derived from that archive; none of them use any data beyond what the snapshots already contain.

• Rating trend and review velocity: the star average charted over time, plus new reviews per week averaged over the trailing 90 days. Flat series are hidden.
• Health trend: the same composite health score, snapshotted daily and charted per plugin. The Health page lists the biggest gains and drops between two dates.
• Stickiness: 30-day downloads per 1,000 active installs. Update releases spike it; a long slide means an aging install base.
• Directory rank: the plugin's position in the directory's popularity order, recorded at crawl time daily since 2026-07-12 and charted per plugin against its closest rivals. Earlier rank history from the archive is charted too, but the two eras are never mixed, because they ranked different plugin sets.
• Milestone velocity: how long a plugin sat in each install tier before crossing, and a projected date for the next tier from the least-squares trend of the last 180 days of installs. Projections beyond five years are suppressed.
• Install spikes: install tiers that multiplied by 3x or more in a single observation. This feed describes the jump only; big jumps sometimes have honest causes, and conduct conclusions belong to the integrity thresholds below.
• Keyword tracking: wp.org search positions recorded daily for a fixed keyword list, for any keyword whose rankings page has ever been visited, and for the tags each tracked plugin declares in its own readme. wp.org keeps no public history of these, so the trend starts the day tracking begins and is never backfilled.

Install conversion

Active installs divided by lifetime downloads: the share of everything ever downloaded that is still running somewhere. WordPress.org publishes both numbers and no ratio.

Read it against a cohort, never on its own. The download counter includes every update every site has ever pulled, so a plugin that ships weekly and has been in the directory for a decade reads low for reasons that say nothing about whether people keep it. Every plugin page that shows a rate shows the median for its category beside it, computed over plugins that report both numbers, with bundled and boosted install bases excluded. A category with fewer than 20 such plugins falls back to the whole directory, and below that the rate renders with no verdict at all.

The figure is a floor. WordPress.org reports active installs as the bottom of a band, so a plugin shown as 1,000+ may be running on nearly twice that, and its real conversion is the printed rate or higher.

Search momentum

A leading indicator built from keyword history. Search position moves before installs do, because a position change has to turn into clicks and then into installs before it reaches the download curve. Three parts, each measured across every keyword we hold two or more dated observations for:

• Velocity: mean positions gained per keyword across the window.
• Breadth: the share of those keywords that improved. One keyword jumping twenty places is a different thing from every keyword drifting up, and breadth is what separates them.
• Acceleration: the second half of the window against the first. Reported as unknown, not as zero, when no keyword has enough dated observations to split.

Each part is squashed into a bounded range before it is weighted (0.45, 0.35, 0.20), so no single keyword can carry the score, and the result is mapped onto 0 to 100 where 50 means going nowhere rather than average. Below three measurable keywords, or a span under a week, there is no score: the mean would be one plugin's luck. The actions listed under the table come from the same rows, and the first of them is usually a tag the plugin already ranks for and does not declare.

AI assistants

For each of 30 plugin topics we put two to three natural phrasings of the category question ("What's the best backup plugin for WordPress?") to ChatGPT and Claude, with Gemini and Perplexity when enabled, through their APIs, with each vendor's web search on, and ask three times per phrasing because the same question gets different answers from one ask to the next. Each answer is stored whole. The assistant is asked to end with a single line listing the plugins it recommended, in order; that line is parsed, names are matched to WordPress.org slugs only on an exact or unambiguous match, and anything else is kept as the raw name. "Named in 7 of 12 answers" means exactly that for the latest run: it is an observation, not a claim about why an assistant chose a plugin.

Beside every topic sits WordPress.org's own result page for the matching search, from the same keyword tracking the merit rankings use. Readme readiness is a separate, deterministic checklist over the plugin's listing (short description, FAQ, audience and integration mentions, headings and lists, length, tags) with no model involved; it says whether the readme gives an assistant something to quote, not whether it will.

Opportunities

A niche is a search we track: the plugins wp.org returns for it, minus any whose name, short description and tags don't use the search's words (wp.org pads results with giants that match on something else). Plural and reordered spellings ("forms" and "form", "seo ai" and "ai seo") count as one niche, and so do searches that return the same market: two niches fold together when at least half their plugins are shared (Jaccard overlap 0.5) and every search in the group shares at least a quarter with every other, so "elementor addons" and "elementor widgets" become one row while "firewall" and "malware" stay apart. The merged niche takes the name of its search with the most demand. Categories are scored the same way on their 24 most-installed plugins.

A search becomes a niche when at least five of its results are on topic and they take at least 3,000 downloads a month between them; the 800 with the most downloads are kept. The board is rebuilt every night from stored data.

Demand is those plugins' monthly downloads summed from our daily snapshots, the latest reading against 30 or 90 days earlier, over the plugins read on both dates. A date only counts when 80% of the niche has a reading on it. When the latest such date is more than two weeks old, or no such date falls within ten days of the window start, the niche says "not enough history" instead of a number. Downloads lead installs, which wp.org reports in coarse bands, but a 30-day download count also jumps when a big plugin ships an update, which is why 90 days is the default.

The score is three parts, each from 0 to 1:

• Demand: download change mapped from −10% (0) to +50% (1).
• Open field: the leader's share of the niche's installs, mapped from 90% (0) to 30% (1).
• Incumbent weakness: across the top five results, how many of four observed weaknesses each shows (health under 60, last updated over a year ago, a Wilson lower bound under 70% positive on its star ratings, under 40% of support threads resolved), two or more counting as fully weak. It runs from 0.3 to 1, so healthy incumbents lower a score without zeroing it.

Score = 100 × ∛(demand × open field × weakness) × (1 + 0.05 per newcomer, up to three), capped at 100. A newcomer is a plugin added in the last year that climbed at least one install band in the window. The cube root keeps the scale readable while a zero in any part still zeroes the score: a shrinking niche or one plugin owning the installs isn't an opening however weak the field. Niches under 3,000 monthly downloads aren't scored, since a swing there is one release. Review complaints come from stored review analysis only; nothing on these pages calls a model.

wp.org data covers the free side only, so markets that live on premium plugins (membership, WooCommerce extensions, LMS) look smaller than they are. The board is a shortlist for research, and every label on it describes what the data shows, not why.

Integrity watch

Separately from ranking signals, a plugin is flagged as artificially boosted only when hard thresholds are all met at once: 200,000+ active installs, a rating under 3★, almost nobody reviewing it relative to its size (fewer than 50 reviews per 100,000 installs), a statistically robust negative review consensus (Wilson lower bound under 0.4), and a published WP Mayor investigation documenting what happened. That is the only label on the site that implies conduct, which is why the bar is high and the evidence is linked.

A second, neutral flag marks install bases that don't reflect chosen adoption. People review plugins they picked; across the directory, plugins installed by choice sit well above 10 reviews per 10,000 installs. So at 50,000+ installs, fewer than 1 review per 10,000 installs earns the flag on the ratio alone. Between 10,000 and 50,000 installs the ratio is ambiguous (a niche-but-real plugin can look the same), so the flag additionally requires the install trajectory to show a long plateau followed by a multi-tier climb within weeks: the shape of a distribution change, not organic growth. This flag makes no accusation. Bundling and preinstallation are legitimate ways to ship software; the flag only says the install count is a weak popularity signal, so these plugins sit out the install-based leaderboards while their health grade is untouched. Officially promoted publishers (WordPress.org, the Performance Team, Automattic) are exempt: their thin review trails come from core and directory promotion, not commercial bundling.

Independence

Every score, rank and flag on this site is computed from the data and thresholds described above, or backed by a published WP Mayor review. Nothing here is set by hand or by relationship. If a plugin ranks well, its numbers earned it; if one is flagged, a stated threshold was crossed or an investigation documented it, and the evidence is linked.

Two relationships are worth stating plainly. Plugin Pulse is built by WP Mayor, which also sells a paid plugin-promotion service; and its founder runs RebelCode, whose plugins (WP RSS Aggregator, Spotlight) appear in this dataset like any other. Neither buys standing here. Promotion spend never moves a health or merit score, and never lifts or suppresses an integrity flag. RebelCode's plugins are scored by the same formulas as everything else, with no exemption. The whole point of the site is a signal you can trust, so the moment a score could be bought, it would be worthless.

Data

Live data comes from the public WordPress.org APIs. Trend history combines our own daily snapshots with a historical archive assembled from public sources, and every stored data point is tagged with its origin. Install history reaches back to October 2022 for most tracked plugins, the month wp.org removed its active-install growth charts, and to 2015 for a smaller set reconstructed from web archives. Download history reaches back to October 2022. Plugin Pulse is built by WP Mayor and is not affiliated with WordPress.org.